Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108865AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize

High 8.2

In plain English

A high-severity improper authentication in Unla from AmoyLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 74.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.

Affected products (as reported)

Vendor	Product	Versions
AmoyLab	Unla	0 – through 0.10.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/amoylab-unla-oauth-self-issued-token-authz third-party-advisory
https://github.com/AmoyLab/Unla/blob/v0.10.0/internal/auth/oauth.go#L86-L147 technical-description
https://github.com/AmoyLab/Unla/blob/v0.10.0/internal/core/server.go#L229-L261 technical-description
https://github.com/AmoyLab/Unla product
VulnCheck Advisory: AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize third-party-advisory